# CVE-2026-17563: WordPress User Frontend unauthenticated post creation via subscription bypass

Source: https://junglewise.ai/threats/cve-2026-17563-wordpress-user-frontend-unauthenticated-post-creation-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-17563 · Severity: medium · CVSS 5.3 · Published 2026-09-02

User Frontend is a WordPress plugin that allows site owners to create forms for user registration, content submission, and membership management. The plugin fails to enforce subscription-purchase requirements when processing form submissions on the server side, allowing unauthenticated attackers to bypass payment restrictions and create or publish posts directly through the admin-ajax endpoint. This enables unauthorized content publication and potential defacement or spam injection.

## Quick answers

**Is CVE-2026-17563 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-17563 being exploited in the wild.

**How severe is CVE-2026-17563?** Medium severity, with a CVSS score of 5.3, published 2 September 2026.

**Which products and versions are affected?** WP User Frontend User Frontend before 4.3.11.

**Is there a fix for CVE-2026-17563?** A patch was published on 2026-09-02: Fixed in version 4.3.11 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-17563 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-17563?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in the post submission handler. The plugin enforces subscription checks only when rendering the form to the user, but fails to re-validate the subscription requirement when the unauthenticated wpuf_submit_post AJAX action is invoked. An attacker can obtain a valid nonce from any publicly accessible guest post form, enumerate the form ID of a subscription-restricted form (which accepts guest submissions), and send a forged submission request to wp-admin/admin-ajax.php. The server processes the submission without re-checking subscription status, allowing post creation with immediate publication status. The attack requires the form to be configured with guest posting enabled, but no valid session cookie or authentication credentials.

## Affected products

- WP User Frontend User Frontend before 4.3.11

## Timeline

- 2026-08-31: disclosed
- 2026-09-02: patched: Fixed in version 4.3.11

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://wpscan.com/vulnerability/293b7391-ac1a-4ec5-95d1-4578391906b2/](https://wpscan.com/vulnerability/293b7391-ac1a-4ec5-95d1-4578391906b2/)